Australian Open’s cyber security partner says it avoided a Medibank or Optus-style breach

Despite an onslaught of malicious activity, the Open’s inaugural cyber security partner says tennis avoided a Medibank or Optus-style breach.

CyberCX chief executive John Paitaridis says numerous attempts were made to breach Tennis Australia’s defences. Picture: Mark Dadswell

Tennis Australia’s cyber security partner, CyberCX, thwarted numerous threats at the Australian Open, the company has revealed.

It successfully helped the event avoid an Optus-style data breach despite a significant increase in malicious activity.

The Open reported a seven-fold increase in traffic through the environments it safeguarded as the tournament commenced, The Australian understands, as well as an uptick in malicious activity attempting to break through Tennis Australia’s defences.

CyberCX, which was launched in 2019 and is now the nation’s largest cyber security services provider, was protecting the Open against a range of threat actors, including for-profit criminal groups and individuals, hacktivists who seek to derail high-profile events to draw attention to political causes, and state-sponsored groups who are motivated to embarrass countries like Australia on the world stage, chief executive John Paitaridis said in an interview.

Tennis Australia ultimately avoided an outcome suffered by companies such as Medibank and Optus and no successful breaches occurred, despite the Open’s power and profile making it an attractive target.

CyberCX chief executive John Paitaridis. Picture: Mark Dadswell

“I can confirm no threats were able to able to compromise the cyber security of the Australian Open and that’s something we are very proud of,” Mr Paitaridis said.

“Our partnership involved us reviewing the attack surface, as we call it, and getting a sense of what threats we thought were going to be most relevant to the Australian Open; and we reviewed the cyber security protocols and the security controls of the environment prior to the event and in the planning phase of it.

“We did an organisation-wide capability uplift for Tennis Australia, focused on hardening their security fences, and through the event we deployed detection and monitoring capabilities so that we had eyes on the environment, and across all the technology and digital data that ultimately runs the event.

“And we’re pleased to say that no threats were able to compromise the event.”

He said the uptick in malicious activity currently affecting Australian businesses and government agencies also extended to the Australian Open, which had not previously had a cyber security partner.

Aryna Sabalenka embraces the Daphne Akhurst Memorial Cup after winning the women’s final. Picture: Getty Images

“We expected an increase in threat activity and that’s what we saw,” Mr Paitaridis said. “Our goal is to protect and defend the Australian Open working as an extension of Tennis Australia and we achieved that outcome.

Tennis Australia chief technology officer Ben Fitzgerald said CyberCX had integrated as an extension to the Tennis Australia technology team during the event.

“There has never been a more important time to have the right cyber security partner,” Mr Fitzgerald said.

“Technology and data increasingly underpin all aspects of the Australian Open, which makes protection from cyber attacks critically important.”

Corporate Australia is still reeling from last year’s high-profile Medibank and Optus data breaches, during which millions of customers’ data was stolen.

Multiple potential class action lawsuits are pending against both companies, over claims they breached the Privacy Act and failed to adequately protect the personal information of their customers.

Mr Paitaridis echoed comments by federal Home Affairs Minister Clare O’Neil, who previously described the Medibank and Optus data breaches as a wake-up call for both corporate Australia and the government.

He said the two incidents should serve as a warning for corporate Australia and businesses across all industries to better understand the threat environment that they’re operating in.

Men’s finals winner Novak Djokovic poses with the Norman Brookes Challenge Cup. Picture: Getty Images

“They need to make sure they’re preparing cyber security strategies and putting them in place, that they’re understanding the threats, and putting in place security controls and practices to uplift their posture, and making sure their IT teams are cyber aware,” he said.

Australia has set a target to become “the most cyber secure country in the world by 2030”, and the government has commissioned a new cyber security strategy to be led by former Telstra chief executive Andy Penn.

“We were pleased and highly supportive of having a cyber security minister that’s part of the cabinet in Claire O’Neil, who we think is doing a great job,” Mr Paitaridis said.

“This is a complex and challenging area for industry, for government, for business and for the economy. There’s a lot of important legislation to be prepared and regulatory considerations that the government is working through.

“We’re making our contribution as a good industry player, we’re providing input and we will encourage more investment in cyber security, more investment in the cyber security workforce, and more support for the industry as we continue to participate in what is a team game in lifting the security posture and capabilities of the country.”